<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Troubleshooting</title>
<link rel="stylesheet" type="text/css" href="../C.css">
<script type="text/javascript" src="../jquery.js"></script><script type="text/javascript" src="../jquery.syntax.js"></script><script type="text/javascript" src="../yelp.js"></script>
</head>
<body id="home">
<!--<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">
        _uacct = "UA-1018242-8";
        urchinTracker();
      </script><script>
      function englishPageVersion() {
        var href = window.location.href;
        if (href.slice(-1) == "/") {
                window.location = "index.html.en";
        } else {
                window.location = href.replace(/\.html.*/, ".html.en");
        }
         return false;
      }
      function browserPreferredLanguage() {
        var href = window.location.href;
        if (href.slice(-1) == "/") {
                window.location = href;
        } else {
                window.location = href.replace(/\.html.*/, ".html");
        }
        return false;
      }
      </script>--><div id="container">
<div id="container-inner">
<div id="mothership"><ul>
<li><a href="https://partners.ubuntu.com">Partners</a></li>
<li><a href="https://www.ubuntu.com/support/community-support">Support</a></li>
<li><a href="https://community.ubuntu.com">Community</a></li>
<li><a href="https://www.ubuntu.com">Ubuntu.com</a></li>
</ul></div>
<div id="header">
<h1 id="ubuntu-header"><a href="https://help.ubuntu.com/">Ubuntu Documentation</a></h1>
<ul id="main-menu">
<li><a class="main-menu-item current" href="https://help.ubuntu.com/">Official Documentation</a></li>
<li><a href="https://help.ubuntu.com/community/CommunityHelpWiki">Community Help Wiki</a></li>
<li><a href="https://community.ubuntu.com/t/contribute/26">Contribute</a></li>
</ul>
</div>
<div id="menu-search"><div id="search-box">
<noscript><form action="https://www.google.com/cse" id="cse-search-box"><div>
<input type="hidden" name="cx" value="003883529982892832976:e2vwumte3fq"><input type="hidden" name="ie" value="UTF-8"><input type="text" name="q" size="21"><input type="submit" name="sa" value="Search">
</div></form></noscript><!--
<script>
                document.write('<form action="https://help.ubuntu.com/search.html" id="cse-search-box">');
                document.write('  <div>');
                document.write('    <input type="hidden" name="cof" value="FORID:9">');
                document.write('    <input type="hidden" name="cx" value="003883529982892832976:e2vwumte3fq">');
                document.write('    <input type="hidden" name="ie" value="UTF-8">');
                document.write('    <input type="text" name="q" size="21">');
                document.write('    <input type="submit" name="sa" value="Search">');
                document.write('  </div>');
                document.write('</form>');
              </script>-->
</div></div>
<div class="trails"><div class="trail">
<a href="https://help.ubuntu.com/18.04" class="trail">Ubuntu 18.04</a> » <a class="trail" href="../index.html" title="Ubuntu Server Guide">Ubuntu Server Guide</a> » <a class="trail" href="dns.html" title="Domain Name Service (DNS)">Domain Name Service (DNS)</a> » </div></div>
<div id="cwt-content" class="clearfix content-area"><div id="page">
<div id="content">
<div class="links nextlinks">
<a class="nextlinks-prev" href="dns-configuration.html" title="Configuration">Previous</a><a class="nextlinks-next" href="dns-references.html" title="References">Next</a>
</div>
<div class="hgroup"><h1 class="title">Troubleshooting</h1></div>
<div class="region">
<div class="contents"><p class="para">
	This section covers ways to help determine the cause when problems happen with DNS and <span class="app application">BIND9</span>. 
	</p></div>
<div class="links sectionlinks" role="navigation"><ul>
<li class="links"><a class="xref" href="dns-troubleshooting.html#dns-testing" title="Testing">Testing</a></li>
<li class="links"><a class="xref" href="dns-troubleshooting.html#dns-logging" title="Logging">Logging</a></li>
</ul></div>
<div class="sect2 sect" id="dns-testing"><div class="inner">
<div class="hgroup"><h2 class="title">Testing</h2></div>
<div class="region">
<div class="contents"></div>
<div class="sect3 sect" id="dns-resolv.conf"><div class="inner">
<div class="hgroup"><h3 class="title">resolv.conf</h3></div>
<div class="region"><div class="contents">
<p class="para">
	    The first step in testing <span class="app application">BIND9</span> is to add the nameserver's IP Address to a hosts resolver.
	    The Primary nameserver should be configured as well as another host to double check things.
	    Refer to <a class="xref" href="network-configuration.html#dns-client-configuration" title="DNS Client Configuration">DNS Client Configuration</a> for details on adding nameserver addresses to your network clients, and afterwards check
	    that the file <span class="file filename">/etc/resolv.conf</span> contains (for this example):
	    </p>
<div class="code"><pre class="contents ">nameserver	192.168.1.10
nameserver	192.168.1.11
</pre></div>
<p class="para">
            Nameservers that listen at 127.* are responsible for adding their own IP addresses to resolv.conf (using resolvconf).
            This is done via the file <span class="file filename">/etc/default/bind9</span> by changing the line RESOLVCONF=no to RESOLVCONF=yes.
            </p>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
	      <p class="para">
	      You should also add the IP Address of the Secondary nameserver in case the Primary becomes unavailable.
	      </p>
	    </div></div></div></div>
</div></div>
</div></div>
<div class="sect3 sect" id="dns-testing-dig"><div class="inner">
<div class="hgroup"><h3 class="title">dig</h3></div>
<div class="region"><div class="contents">
<p class="para">
	    If you installed the <span class="app application">dnsutils</span> package you can test your setup using the DNS lookup utility
	    <span class="app application">dig</span>: 
	    </p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
	        <p class="para">
	        After installing <span class="app application">BIND9</span> use <span class="app application">dig</span> against the
	        loopback interface to make sure it is listening on port 53.  From a terminal prompt:
	        </p>
<div class="screen"><pre class="contents "><span class="cmd command">dig -x 127.0.0.1</span>
</pre></div>
	        <p class="para">
	        You should see lines similar to the following in the command output:
	        </p>
<div class="code"><pre class="contents ">;; Query time: 1 msec
;; SERVER: 192.168.1.10#53(192.168.1.10)
</pre></div>
	      </li>
<li class="list itemizedlist">
	        <p class="para">
		If you have configured <span class="app application">BIND9</span> as a <span class="em emphasis">Caching</span> nameserver "dig" an outside
	        domain to check the query time:
	        </p>
<div class="screen"><pre class="contents "><span class="cmd command">dig ubuntu.com</span>
</pre></div>
	        <p class="para">
	        Note the query time toward the end of the command output:
	        </p>
<div class="code"><pre class="contents ">;; Query time: 49 msec
</pre></div>
	        <p class="para">
	        After a second dig there should be improvement:
	        </p>
<div class="code"><pre class="contents ">;; Query time: 1 msec
</pre></div>
	      </li>
</ul></div>
</div></div>
</div></div>
<div class="sect3 sect" id="dns-testing-ping"><div class="inner">
<div class="hgroup"><h3 class="title">ping</h3></div>
<div class="region"><div class="contents">
<p class="para">
            Now to demonstrate how applications make use of DNS to resolve a host name use the
 	    <span class="app application">ping</span> utility to send an ICMP echo request.  From a terminal prompt enter:
	    </p>
<div class="screen"><pre class="contents "><span class="cmd command">ping example.com</span>
</pre></div>
<p class="para">
	    This tests if the nameserver can resolve the name <span class="em emphasis">ns.example.com</span> to an IP Address.
	    The command output should resemble:
	    </p>
<div class="code"><pre class="contents ">PING ns.example.com (192.168.1.10) 56(84) bytes of data.
64 bytes from 192.168.1.10: icmp_seq=1 ttl=64 time=0.800 ms
64 bytes from 192.168.1.10: icmp_seq=2 ttl=64 time=0.813 ms
</pre></div>
</div></div>
</div></div>
<div class="sect3 sect" id="dns-testing-configuration"><div class="inner">
<div class="hgroup"><h3 class="title">named-checkzone</h3></div>
<div class="region"><div class="contents">
<p class="para">
	    A great way to test your zone files is by using the <span class="app application">named-checkzone</span> utility installed with the 
	    <span class="app application">bind9</span> package.  This utility allows you to make sure the configuration is correct
	    before restarting <span class="app application">BIND9</span> and making the changes live.
	    </p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
	        <p class="para">
	        To test our example Forward zone file enter the following from a command prompt:
	        </p>
<div class="screen"><pre class="contents "><span class="cmd command">named-checkzone example.com /etc/bind/db.example.com</span>
</pre></div>
	        <p class="para">
	        If everything is configured correctly you should see output similar to:
	        </p>
<div class="code"><pre class="contents ">zone example.com/IN: loaded serial 6
OK
</pre></div>
	      </li>
<li class="list itemizedlist">
	        <p class="para">
	        Similarly, to test the Reverse zone file enter the following:
	        </p>
<div class="screen"><pre class="contents "><span class="cmd command">named-checkzone 1.168.192.in-addr.arpa /etc/bind/db.192</span>
</pre></div>
	        <p class="para">
	        The output should be similar to:
	        </p>
<div class="code"><pre class="contents ">zone 1.168.192.in-addr.arpa/IN: loaded serial 3
OK
</pre></div>
	      </li>
</ul></div>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
	     <p class="para">
	     The <span class="em emphasis">Serial Number</span> of your zone file will probably be different.
	     </p>
	    </div></div></div></div>
</div></div>
</div></div>
</div>
</div></div>
<div class="sect2 sect" id="dns-logging"><div class="inner">
<div class="hgroup"><h2 class="title">Logging</h2></div>
<div class="region"><div class="contents">
<p class="para">
	  <span class="app application">BIND9</span> has a wide variety of logging configuration options available. There are two main options.  The 
	  <span class="em emphasis">channel</span> option configures where logs go, and the <span class="em emphasis">category</span> option determines what information to log.
	  </p>
<p class="para">
	  If no logging option is configured the default option is: 
	  </p>
<div class="code"><pre class="contents ">logging {
     category default { default_syslog; default_debug; };
     category unmatched { null; };
};
</pre></div>
<p class="para">
	  This section covers configuring <span class="app application">BIND9</span> to send <span class="em emphasis">debug</span> messages related to DNS queries to a separate file. 
	  </p>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
	      <p class="para">
	      First, we need to configure a channel to specify which file to send the messages to. Edit <span class="file filename">/etc/bind/named.conf.local</span>
	      and add the following: 
	      </p>
<div class="code"><pre class="contents ">logging {
    channel query.log {      
        file "/var/log/query.log";
        severity debug 3; 
    }; 
};
</pre></div>	    
	    </li>
<li class="list itemizedlist">
	      <p class="para">
	      Next, configure a category to send all DNS queries to the query file:
	      </p>
<div class="code"><pre class="contents ">logging {
    channel query.log {      
        file "/var/log/query.log"; 
        severity debug 3; 
    }; 
    <span class="em emphasis">category queries { query.log; };</span> 
};
</pre></div>	    
	    </li>
</ul></div>
<div class="note" title="Note"><div class="inner"><div class="region"><div class="contents">
	    <p class="para">
	    Note: the <span class="em emphasis">debug</span> option can be set from 1 to 3. If a level isn't specified level 1 is the default.
	    </p>
	  </div></div></div></div>
<div class="list itemizedlist"><ul class="list itemizedlist">
<li class="list itemizedlist">
	      <p class="para">
	      Since the <span class="em emphasis">named daemon</span> runs as the <span class="em emphasis">bind</span> user the <span class="file filename">/var/log/query.log</span>
	      file must be created and the ownership changed:
	      </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo touch /var/log/query.log</span>
<span class="cmd command">sudo chown bind /var/log/query.log</span>
</pre></div>
	    </li>
<li class="list itemizedlist">
	      <p class="para">
	      Before <span class="app application">named</span> daemon can write to the new log file the <span class="app application">AppArmor</span>
	      profile must be updated.  First, edit <span class="file filename">/etc/apparmor.d/usr.sbin.named</span> and add:
	      </p>
<div class="code"><pre class="contents ">/var/log/query.log w,
</pre></div>
	      <p class="para">
	      Next, reload the profile:
	      </p>
<div class="screen"><pre class="contents "><span class="cmd command">cat /etc/apparmor.d/usr.sbin.named | sudo apparmor_parser -r</span>
</pre></div>
	      <p class="para">
               For more information on <span class="app application">AppArmor</span> see <a class="xref" href="apparmor.html" title="AppArmor">AppArmor</a>
	      </p>
	    </li>
<li class="list itemizedlist">
	      <p class="para">
	      Now restart <span class="app application">BIND9</span> for the changes to take effect:
	      </p>
<div class="screen"><pre class="contents "><span class="cmd command">sudo systemctl restart bind9.service</span>
</pre></div>
	    </li>
</ul></div>
<p class="para">
	  You should see the file <span class="file filename">/var/log/query.log</span> fill with query information. This is a simple example of the 
	  <span class="app application">BIND9</span> logging options.  For coverage of advanced options see <a class="xref" href="dns-references.html#dns-more-info" title="More Information">More Information</a>.
	  </p>
</div></div>
</div></div>
</div>
<div class="links nextlinks">
<a class="nextlinks-prev" href="dns-configuration.html" title="Configuration">Previous</a><a class="nextlinks-next" href="dns-references.html" title="References">Next</a>
</div>
<div class="clear"></div>
</div>
<div id="pagebottom"></div>
</div></div>
</div>
<div id="footer"><p>The material in this document is available under a free license, see <a href="https://help.ubuntu.com/legal.html">Legal</a> for details.<br>
          For information on contributing see the <a href="https://wiki.ubuntu.com/DocumentationTeam">Ubuntu Documentation Team wiki page</a>.
          To report errors in this serverguide documentation, <a href="https://bugs.launchpad.net/serverguide">file a bug report</a>.</p></div>
</div>
</body>
</html>
